msxml3: Protect from null pointer in load().

dlls/msxml3/domdoc.c

@@ -2093,6 +2093,7 @@ static HRESULT WINAPI domdoc_load(
         }
         break;
     case VT_UNKNOWN:
+        if (!V_UNKNOWN(&source)) return E_INVALIDARG;
         hr = IUnknown_QueryInterface(V_UNKNOWN(&source), &IID_IXMLDOMDocument3, (void**)&pNewDoc);
         if(hr == S_OK)
         {

dlls/msxml3/tests/domdoc.c

@@ -10749,6 +10749,13 @@ static void test_load(void)
 
     doc = create_document(&IID_IXMLDOMDocument);
 
+    /* null pointer as input */
+    V_VT(&src) = VT_UNKNOWN;
+    V_UNKNOWN(&src) = NULL;
+    hr = IXMLDOMDocument_load(doc, src, &b);
+    EXPECT_HR(hr, E_INVALIDARG);
+    ok(b == VARIANT_FALSE, "got %d\n", b);
+
     path = _bstr_("test.xml");
 
     /* load from path: VT_BSTR */